Which practice is recommended when preserving digital evidence during seizure?

• A. Delete Data to Secure Storage.
• B. Document Device Condition, Locations, and Power States Upon Seizure.
• C. Modify Metadata to Hide Activity.
• D. Reformat Device Immediately.

Answer: (B)

When seizing digital devices, capturing the context and state of the device at the moment of seizure is essential for maintaining evidence integrity. Documenting the device’s condition, the exact location where it was found, and whether it is powered on or off creates a verifiable snapshot that supports later forensic analysis and court admissibility. The power state matters because volatile data in RAM can be lost if the device is powered down or disrupted, and noting it informs investigators on how to handle the device to preserve potential evidence. Recording the physical condition and surroundings helps establish chain of custody and ensures nothing is overlooked or tampered with. Deleting data, modifying metadata, or reformatting would destroy or alter evidence and undermine credibility, which is why those actions are avoided.